Latency, Cost, Safety and Security Metrics

1.Latency: which clock are you measuring?

Latency is the time the model takes to process a prompt and produce an output. It depends on model size, prompt complexity and the infrastructure in between. Saying 'it should be fast' isn't enough, because the latency guide distinguishes two different measurements. Baseline latency is the time to process the prompt and generate the response, without considering input and output tokens per second, so it gives a general sense of the model's speed. Time to first token (TTFT) is the time from sending the prompt until the first token of the response appears. TTFT matters most when you stream responses and want users to see output quickly.

The acceptable value depends on your application's real-time requirements and on what users expect, so write the target as a distribution rather than an average. The guide's multidimensional example requires 95% of responses in under 200ms. For agent evaluations, Anthropic's agent post tracks latency next to transcript metrics such as turns, tool calls and total tokens, so a single evaluation run records them all.

  tracked_metrics:
    - type: transcript
      metrics:
        - n_turns
        - n_toolcalls
        - n_total_tokens
    - type: latency
      metrics:
        - time_to_first_token
        - output_tokens_per_sec
        - time_to_last_token

Sources12

2.Cost: per call, per task, against a threshold

The testing guidance asks what your budget is for running the model, and points to three factors: the cost of each API call, the size of the model, and how often it's used. To turn that into a metric, record token usage on every call. The ticket-routing evaluation does this by reading the usage statistics the API returns with each response, then calculating cost from the input and output tokens.

    message = client.messages.create(
        model=DEFAULT_MODEL,
        max_tokens=500,
        messages=[{"role": "user", "content": classification_prompt}],
    )
    usage = message. ?   # Get the usage statistics for the API call for how many input and output tokens were used.

Like accuracy, cost needs a threshold. The routing guide's target is relative: a 50% average reduction in cost per classification, across 100 tests, compared with the current routing method.

Per-token price is an input to the metric, not the metric itself. Anthropic's cost guidance says to compare models on cost per completed task, and its agent-evaluation post notes that once you have an evaluation, cost per task can be tracked over a fixed set of tasks together with latency, token usage and error rates. That gives you regression baselines without extra work.

Sources234

3.Safety: quantify the 'hazy' criteria

Safety can seem too subjective to measure, but the testing guidance treats it like any other criterion: give it a rate, a sample size and a measuring instrument. Its bad example is simply 'Safe outputs'. Its good example is: less than 0.1% of outputs, out of 10,000 trials, flagged for toxicity by the content filter. That criterion names the rate, the sample size and the tool that decides what counts as toxic.

The multidimensional criterion from the guide adds a second, severity-weighted safety target: 90% of errors should cause inconvenience rather than egregious error. The guide notes that you would also have to define 'inconvenience' and 'egregious' for your own application. Safety can also cover knowing when to stop: the customer-support guide measures whether the model escalates conversations that need a human, aiming for 95% escalation accuracy or higher.

Sources25

4.Security: define what an attack looks like, then check for it

These sources give no numeric security target to copy. They do provide two things you need to write one: the threats to measure against, and the kinds of checks that can detect them. The resulting criterion should follow the same specific, measurable approach as safety.

Start with the threat model. Anthropic's guardrail documentation describes jailbreaking and prompt injection as attempts to make Claude ignore its guidelines or your instructions, and splits them into two categories. In jailbreaks and direct prompt injection, the user is the adversary and crafts inputs to bypass your guardrails. In indirect prompt injection, the user is trusted, but Claude processes third-party content, such as web pages, emails, documents or tool results, that contains adversarial instructions. A security evaluation that only includes malicious user inputs misses the second category.

The testing guidance adds a data-protection dimension. Decide what a successful metric looks like for how the model handles personal or sensitive information, including whether it follows instructions not to use or share certain details.

For agents, the agent-evaluation post lists security among the static-analysis checks a code-based grader can run. Its illustrative authentication-bypass task combines a static_analysis grader running bandit with a state_check that expects an auth_blocked event in security_logs. In other words, it checks the security outcome in the environment, not only the agent's claim that it fixed the problem.

Sources624

Exam traps

Each one states something that sounds right. Open it to see what is actually true.

1. 1.Time to first token and overall response latency are the same measurement.Why is that wrong?

   TTFT measures only the wait until the first token arrives, which matters most for streaming. Baseline latency covers processing the prompt and generating the response.

   Covered in Latency: which clock are you measuring?

2. 2.The model with the lowest per-token price is the cheapest choice.Why is that wrong?

   Compare models on cost per completed task. A cheaper token can still cost more overall if the model needs more turns or retries to succeed.

   Covered in Cost: per call, per task, against a threshold

3. 3.Prompt-injection testing only needs adversarial inputs from users.Why is that wrong?

   Indirect prompt injection comes from third-party content such as web pages, emails, documents and tool results, even when the user is trusted.

   Covered in Security: define what an attack looks like, then check for it